# Proof audit, pass 1

No blocking proof defect remains in this audit package. The original PR-body transcript explicitly demonstrates only the personal Argon regression; its aggregate 17/17 line is not per-row runtime output for the other fixtures. The additional stubbed production-probe transcript below fills that limitation. No UI capture is required: this is a server quota-selection fix, and all web, desktop, and mobile rendering code is unchanged. Tests plus a short server runtime transcript are the appropriate proof under the repository rule. A screenshot would show the same values through an unchanged renderer and would not establish which Google host won.

Scope: [#32425](https://git.cafe/pingdotgg/t3code/pull/32425), mirrored as [#32425](https://github.com/pingdotgg/t3code/pull/32425), for [#32419](https://git.cafe/pingdotgg/t3code/issues/32419). Reviewed local merge [837f8be0a3](https://git.cafe/pingdotgg/t3code/commit/837f8be0a312bd3b78e4d9e451bb827f348101f3) against local `origin/main` [20c3dd3689](https://git.cafe/pingdotgg/t3code/commit/20c3dd3689782bfcb1a04332086d08017028c718). The merge is not pushed. Published PR head remains [fea61e0fd2](https://git.cafe/pingdotgg/t3code/commit/fea61e0fd2fe1158071f1ba5453f6ed13099f1b6); the two reviewed files are byte-for-byte unchanged between that head and the local merge. Forge CI/review results therefore describe the published head, not the local merge. No edits, pushes, comments, server launches, or additional worktrees were made.

## Affected paths

- The sole production construction site is [AntigravityDriver.ts](https://git.cafe/pingdotgg/t3code/blob/fea61e0fd2fe1158071f1ba5453f6ed13099f1b6/apps/server/src/provider/Drivers/AntigravityDriver.ts), around line 427. It passes the configured auth method and supplies `usage.probe` and `usage.clear` to the provider. The only other construction site is the unit-test fixture. Every Antigravity provider instance uses this same driver.
- The probe has one direct production executor: `AntigravityProvider.refreshUsage`, around line 235 of [AntigravityProvider.ts](https://git.cafe/pingdotgg/t3code/blob/fea61e0fd2fe1158071f1ba5453f6ed13099f1b6/apps/server/src/provider/AntigravityProvider.ts). Two paths call it: a successful provider health check (line 336), and a session-start notification when limits are absent or unavailable (line 412). The driver also reports catalog-discovery sessions through `publishCatalog` to `onSessionStarted`. Sign-in invalidates the cached usage; sign-out/auth-required interrupts reads and clears account metadata. Those lifecycle paths are unchanged.
- Health checks are shared by initial/background managed-provider refreshes and registry refreshes: manual Usage refresh, provider Settings/status/onboarding, command-palette/model-refresh flows, fresh workspace discovery, install/update notifications, and post-auth refresh. The WS `server.refreshProviders` handler calls these registry paths. Catalog-only refresh checks providers when the manifest changed. These are entry points to the same executor, not distinct host-merging implementations. Agents and scheduled turns use the same session/driver path; there is no separate quota merge in an MCP handler.
- Both `retrieveUserQuotaSummary` and `fetchAvailableModels` use the changed `fetchWindows` helper. Personal prefers daily; business prefers prod. Requests still run concurrently, but results retain input host order. First usable parsed window per ID wins, including the entire window object (percentage, reset presence/time, label, kind, duration). A missing/disabled/nonfinite-fraction bucket is absent after parsing; HTTP/JSON/schema failure or timeout contributes no windows for that host. These collapse to the same missing-key merge cases. Model fallback runs only when the combined summary produces zero usable windows, not when a single group is absent. Within each host, model-family reduction still keeps its most-used model; only the cross-host merge changed.
- The resulting `ServerProvider.usageLimits` schema, credential fingerprint, account pooling, sort order, transport, and publication logic are unchanged. Existing consumers include web/desktop Usage → Limits, per-thread details and composer `/usage` reports, mobile Usage/composer panels and subscription widgets. Existing exhaustion/recovery notices, default new-thread fallback selection, and server text-generation provider selection also consume these numbers. Their rules and render code do not change; corrected values can change their existing decisions. Local, remote/relay, and tunnel clients receive the same server snapshot. Other provider probes are unaffected.

## Fixture matrix

`D` = daily-cloudcode-pa.googleapis.com; `P` = cloudcode-pa.googleapis.com; `r` = remainingFraction. Common supported-auth setup: a synthetic ACP token with project ID, successful token refresh and userinfo responses. All runtime HTTP and filesystem responses are in-memory stubs; no live account, Google connection, or real credential is used. Percent used is `(1-r)*100`.

Parameterized rows avoid duplicating the same set-union/failure behavior for each hostname and auth method. Both auth orders and both failed-host choices were executed where indicated. Tests are in [antigravityUsageLimits.test.ts](https://git.cafe/pingdotgg/t3code/blob/fea61e0fd2fe1158071f1ba5453f6ed13099f1b6/apps/server/src/provider/antigravityUsageLimits.test.ts); the production merge is in [antigravityUsageLimits.ts](https://git.cafe/pingdotgg/t3code/blob/fea61e0fd2fe1158071f1ba5453f6ed13099f1b6/apps/server/src/provider/antigravityUsageLimits.ts).

| Row / named fixture | Input data and expected output | Does the diff affect it? | Existing PR test coverage | Does the existing PR-body transcript cover it? | Minimum evidence / how to produce it | Current status |
| --- | --- | --- | --- | --- | --- | --- |
| S-P — personal duplicate summary | `oauth-personal`; same Argon weekly ID on D/P; D r=.8623059, reset Nov 14 08:41:35Z; P r=0, reset Nov 8 18:27:14Z. Select D: 13.76941% used and Nov 14 reset. | Yes: old output was 100% used and Nov 8 reset. | New personal regression, line 482; exact percentage/reset assertions. | Yes, explicit before failure plus after pass. It executes the real probe under stub HTTP; it is not a live-host transcript. The after block prints pass counts rather than actual JSON. | Existing regression plus short real-probe stub runtime transcript; no UI capture. PR unit fixture or scratch driver works; app stub is optional. | PASS — unit test plus explicit baseline/head runtime output below. |
| S-B — business duplicate summary | `oauth-business`; P must win whether its usage is lower, higher, or tied. Existing test: P weekly r=1 versus D r=.5 at a fixed clock, so 0% used and no rolling reset; P session r=.5 versus D r=1, so 50% and P reset. Scratch variant reverses S-P host payloads so P yields 13.76941%. | Yes: old highest-use rule selected D weekly 50% and its reset. Business equal-usage conflicts also now select P metadata instead of D; same first-key-wins branch. | Modified business regression, line 334, asserts full windows and reset omission. | Aggregate suite pass only; business is mentioned in prose, but its output is not printed. | Existing business regression at the same merge layer, plus shared stub runtime evidence; no UI capture. Scratch driver can choose distinct per-host payloads. | PASS — unit assertions and business runtime output. |
| S-U — summary union / one-host-only buckets | Both auth methods; D has daily-only r=.8 and shared r=.9/reset Jan 1 2030; P has prod-only r=.7 and shared r=.4/reset Jan 2. Keep both unique IDs (20%, 30%); shared is 10%/D reset for personal, 60%/P reset for business. A bucket omitted/disabled/unusable on one host is the same absent-key case. | Duplicate shared ID changes; unique-ID inclusion is preserved. Grouped and top-level summary parsing are unchanged. | Group-fallback test, line 449: prod-only Gemini survives; duplicate shared weekly changes from 100% to daily 50%. Existing parsing/disabled-fraction tests cover normalized inputs. It does not directly assert a daily-only ID. | Aggregate suite pass only, not union values. | Existing merge/parse tests plus a union stub response; do not add tests at UI call sites. Scratch driver below executes both unique directions and both auth methods; app stub also possible. No UI capture. | PASS — existing tests and both-auth runtime union outputs. |
| S-F — one summary host fails | S-U data with D 503 or P 503; run each with personal and business. Return the surviving host's complete windows; do not call model fallback while any summary window survives. Empty/unparseable host output has the same post-parse shape. | Final surviving values are unchanged; business request order changes. Guards the retained failover behavior. | Single-host failure test, line 539, covers personal with D 503. | Aggregate suite pass only. | One focused failure unit case plus shared-helper analysis is enough; scratch runtime additionally covers all four auth/failed-host combinations and asserts no model requests. No UI capture. | PASS — unit representative plus four runtime variants. |
| M-P — personal model fallback with duplicates and unique families | Both summaries 404 (empty usable summaries are equivalent). D models: Gemini r=.9 and .8 (within-host max gives 20%), Claude r=.5; P: Gemini r=.2 and .1 (max gives 90%), GPT r=.6. D/P Gemini reset Feb 1/2 2030. Personal returns Gemini 20%/D reset, Claude 50%, GPT 40%. `weeklyQuotaInfo` follows the same outer merge as `quotaInfo`; its parsing/reset semantics are already tested. | Yes: cross-host Gemini used to be 90%. Within-host most-used reduction and family-unique windows remain. | Fallback tests, lines 395 and 583, prove parser, weekly reset, and within-host reduction; their model payload is identical on both hosts, so they do not directly distinguish cross-host preference. Summary regressions exercise the same changed helper. | No conflicting model-host output. Aggregate fallback test pass does not establish this input. | Use real production probe with per-host model stubs. Scratch driver below does so; no production or test-file edit is needed. Existing unit tests cover the shared merge and model parser at one layer. No UI capture. | PASS — current runtime directly fills the PR transcript's missing model-host example. |
| M-B — business model fallback with duplicates and unique families | Same M-P responses, `oauth-business`. Gemini becomes 90%/P reset; Claude 50% and GPT 40% remain. A preferred-less-used business model payload would use the same first-key-wins branch already distinguished by S-B. | Yes: first-host selection now follows business auth, including equal-use metadata ties. For this chosen numeric variant old max also gives 90%; S-B distinguishes lower-preferred behavior. | Same helper/parser coverage as M-P; no direct per-host business fallback unit case. | No business model-host output. | Reuse M-P scratch fixture with business auth; direct output is sufficient with existing shared-helper tests. App stub possible. No UI capture. | PASS — business runtime output plus S-B lower-preferred regression. |
| M-F — model fallback with one model host failing | Both summaries 404; M-P model data; D 503 or P 503 for `fetchAvailableModels`, each auth method. Keep only survivor: D → Gemini 20%/Feb 1 and Claude 50%; P → Gemini 90%/Feb 2 and GPT 40%. | Surviving values unchanged; business request order changes. Same failure handling as S-F. | No direct model-host failure case; S-F covers the same helper's error-to-empty handling. | No direct model-host failure output. | Shared helper case plus model parser tests are the minimum; scratch driver additionally executes four direct variants. No UI capture. | PASS — four runtime variants. |
| G — unsupported / missing sign-in / no usable quota | API key or absent token → unsupported, zero HTTP requests. Supported OAuth with empty summaries and models → probeFailed, empty windows. OAuth refresh failure → probeFailed before host merge. | No: early guards, auth/cache handling, and final empty-result behavior are unchanged. | API-key/missing-token test line 645, OAuth failure line 635, credential invalidation/account identity tests lines 550/569. | Aggregate suite pass only, no guard outputs. | Existing unit tests suffice for unchanged guards. Scratch driver also prints API-key, missing-token, and empty-response outcomes. No extra UI or live proof. | PASS — unit guards plus three runtime variants. |

## Minimum evidence and limits

The minimum proof is the existing personal and business regressions (percentage and selected reset, including removed rolling resets), existing union/failover cases, existing model parser/fallback cases, and a short runtime transcript from the real server probe with synthetic host responses. The personal baseline/head output below is that transcript; model cross-host variants additionally make the fallback path explicit. Do not add duplicate tests at every client, transport, or provider wrapper: the changed logic is at one server helper. There is no requirement for captures of unchanged UI rendering.

A live Google-host probe and independent validation of auth-method-to-billing-tier correspondence cannot be produced in this environment. In particular, a Workspace account configured with the personal option cannot be empirically validated here. Stubs establish selection behavior for the configured auth method; they cannot prove the external service's actual billing policy. This is the already disclosed limit, not a missing screenshot fixture.

Unit rerun: `vp test run` with a scratch config importing the checkout's server config; only `antigravityUsageLimits.test.ts` included; cache and module cache disabled; TMPDIR, Vite cache, and attachments redirected into the audit scratch directory. All 17 tests passed at the requested local head. No repo-wide checks were run. Native Node loaded the actual production TypeScript probe; an in-memory Effect HTTP client and filesystem supplied only synthetic credentials and responses. Baseline loaded an unmodified scratch copy of the probe from the pinned origin/main. The driver made explicit output assertions, including both-host union, all four summary failover variants, all four model failover variants, and absence of unnecessary model requests when summaries were usable. All 17 current-head fixture executions passed. No UI/browser verification or live traffic is claimed.

## Runtime transcript — before

```text
Production makeAntigravityUsageProbe; synthetic credentials and in-memory HTTP/FileSystem stubs; no live Google requests.
{"fixture":"S-P-before","authMethod":"oauth-personal","windows":{"gemini-argon-wtu-weekly":{"usedPercent":100,"resetsAt":"2026-11-08T18:27:14.000Z"}},"quotaRequests":["daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary"]}
PASS: baseline demonstrates the incorrect most-used host wins.
```

## Runtime transcript — current head

```text
Production makeAntigravityUsageProbe; synthetic credentials and in-memory HTTP/FileSystem stubs; no live Google requests.
{"fixture":"S-P","authMethod":"oauth-personal","windows":{"gemini-argon-wtu-weekly":{"usedPercent":13.76941,"resetsAt":"2026-11-14T08:41:35.000Z"}},"quotaRequests":["daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary"]}
{"fixture":"S-B","authMethod":"oauth-business","windows":{"gemini-argon-wtu-weekly":{"usedPercent":13.76941,"resetsAt":"2026-11-14T08:41:35.000Z"}},"quotaRequests":["cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary"]}
{"fixture":"S-U","authMethod":"oauth-personal","windows":{"daily-only":{"usedPercent":20},"prod-only":{"usedPercent":30},"shared":{"usedPercent":10,"resetsAt":"2030-01-01T00:00:00.000Z"}},"quotaRequests":["daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary"]}
{"fixture":"S-F","authMethod":"oauth-personal","windows":{"prod-only":{"usedPercent":30},"shared":{"usedPercent":60,"resetsAt":"2030-01-02T00:00:00.000Z"}},"quotaRequests":["daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary"]}
{"fixture":"S-F","authMethod":"oauth-personal","windows":{"daily-only":{"usedPercent":20},"shared":{"usedPercent":10,"resetsAt":"2030-01-01T00:00:00.000Z"}},"quotaRequests":["daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary"]}
{"fixture":"S-U","authMethod":"oauth-business","windows":{"daily-only":{"usedPercent":20},"prod-only":{"usedPercent":30},"shared":{"usedPercent":60,"resetsAt":"2030-01-02T00:00:00.000Z"}},"quotaRequests":["cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary"]}
{"fixture":"S-F","authMethod":"oauth-business","windows":{"prod-only":{"usedPercent":30},"shared":{"usedPercent":60,"resetsAt":"2030-01-02T00:00:00.000Z"}},"quotaRequests":["cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary"]}
{"fixture":"S-F","authMethod":"oauth-business","windows":{"daily-only":{"usedPercent":20},"shared":{"usedPercent":10,"resetsAt":"2030-01-01T00:00:00.000Z"}},"quotaRequests":["cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary"]}
{"fixture":"M-P","authMethod":"oauth-personal","windows":{"claude-quota":{"usedPercent":50},"gemini-quota":{"usedPercent":20,"resetsAt":"2030-02-01T00:00:00.000Z"},"gpt-quota":{"usedPercent":40}},"quotaRequests":["daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels","cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels"]}
{"fixture":"M-F","authMethod":"oauth-personal","windows":{"gemini-quota":{"usedPercent":90,"resetsAt":"2030-02-02T00:00:00.000Z"},"gpt-quota":{"usedPercent":40}},"quotaRequests":["daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels","cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels"]}
{"fixture":"M-F","authMethod":"oauth-personal","windows":{"claude-quota":{"usedPercent":50},"gemini-quota":{"usedPercent":20,"resetsAt":"2030-02-01T00:00:00.000Z"}},"quotaRequests":["daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels","cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels"]}
{"fixture":"M-B","authMethod":"oauth-business","windows":{"claude-quota":{"usedPercent":50},"gemini-quota":{"usedPercent":90,"resetsAt":"2030-02-02T00:00:00.000Z"},"gpt-quota":{"usedPercent":40}},"quotaRequests":["cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels","daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels"]}
{"fixture":"M-F","authMethod":"oauth-business","windows":{"gemini-quota":{"usedPercent":90,"resetsAt":"2030-02-02T00:00:00.000Z"},"gpt-quota":{"usedPercent":40}},"quotaRequests":["cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels","daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels"]}
{"fixture":"M-F","authMethod":"oauth-business","windows":{"claude-quota":{"usedPercent":50},"gemini-quota":{"usedPercent":20,"resetsAt":"2030-02-01T00:00:00.000Z"}},"quotaRequests":["cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels","daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels"]}
{"fixture":"G-EMPTY","authMethod":"oauth-personal","windows":{},"unavailable":"probeFailed","quotaRequests":["daily-cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary","daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels","cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels"]}
{"fixture":"G-API","authMethod":"gemini-api-key","windows":{},"unavailable":"unsupported","quotaRequests":[]}
{"fixture":"G-NO-TOKEN","authMethod":"oauth-personal","windows":{},"unavailable":"unsupported","quotaRequests":[]}
PASS: all 17 fixture executions matched explicit expected outputs.
```

## Focused unit-test transcript

```text
note: You are running `vp test` as a Vite+ built-in command. If you meant to run the test npm script, use `vpr test` instead.

 RUN  v5.0.5 /home/user/wt/pr-32425/apps/server

 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > omits rolling resets for untouched summary buckets and keeps used Gemini resets 61ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > uses summary request time after authentication for the reset tolerance 9ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > keeps summary resets with a description, a distant reset, or no quota left 8ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > omits summary resets 59 seconds away but keeps resets 61 seconds away 14ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > reports a business account's quota from the endpoint it is metered on 7ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > keeps full model fallback resets even at a full window from the request 9ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > reports separate Gemini and shared Claude/GPT five-hour and weekly limits 10ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > merges quota groups that only one endpoint reports 7ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > reports a personal account's quota from the daily endpoint it is metered on 8ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > labels Argon's weekly quota apart from the default Gemini weekly quota 7ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > keeps one endpoint's quotas when the other fails 6ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > re-reads changed credentials and clears cached access after sign-out 13ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > names one Google account the same way from every sign-in 12ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > falls back to model quotas without inventing a window duration 7ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > skips disabled and missing fractions and clamps valid percentages 6ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > returns a safe failure when OAuth refresh fails 5ms
 ✓ src/provider/antigravityUsageLimits.test.ts > Antigravity subscription limits > does not make network requests for API keys or missing sign-ins 6ms

 Test Files  1 passed (1)
      Tests  17 passed (17)
   Start at  15:53:07
   Duration  727ms (transform 39%, tests 31%, setup 16%, import 14%)

```

AI-assisted; verified with the tests and tools listed above.

FRICTION: none

VERDICT: SUFFICIENT